Date: Wed, 18 Mar 2009 11:47:33 -0400
From: "Michael K. Johnson" <johnsonm@...th.com>
To: oss-security@...ts.openwall.com
Subject: Re: lxc-sshd security issues?

On Tue, Mar 17, 2009 at 04:02:44PM -0400, Steven M. Christey wrote:
> 
> On Thu, 5 Mar 2009, Michael K. Johnson wrote:
> 
> > I finally got the right contact info upstream, and we're talking
> > about this, so expect it to not be a problem in future releases.
> > For the record, it's dummy auth data, but still could be seen as a
> > backdoor, and will probably be changed to user-configured value.
> 
> By "dummy auth data," do you mean that it's replaced with real/unique
> passwords/keys before the system becomes operational?  Or do these
> pre-packaged values work unless the admin RTFM?  (If the latter, then it
> needs a CVE; if the former, then there doesn't seem to be a vuln because
> there's no impact on authentication).

At least for the root user, I missed (because I was glancing through
the contents of a tarball encoded as base64 data in the script,
not reading the script itself nor actually running it) that when
you run the script it tells you inline that it defaults to the
literal string "root" for the root password for the container.
That immediate inline notification precludes any need for a CVE;
I don't think it's a vulnerability per se.

Also, the script assumes certain specific configuration of the host
system (specifically, a routeable bridge named br0 to which to attach
a virtual ethernet interface) that more or less requires that you
are familiar with what is happening under the hood in order to have
a functioning container.

Sorry to have bothered everyone here...

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux